logo

Database

Reflected cross-site scripting (XSS) In league/commonmark

Description

PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2018-205832. NVD-2018-205833. OSV-2018-205834. GCVE-2018-20583

References

1. https://github.com/thephpleague/commonmark/issues/3372. https://commonmark.thephpleague.com/changelog3. https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2018-20583.yaml4. https://github.com/thephpleague/commonmark/releases/tag/0.18.1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.